CVE-2026-42489 domctl lock open to abuse
An attacker can abuse the domctl system-wide lock to cause a denial of service by preventing fair access to hypervisor operations.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42489?
CVE-2026-42489 is a medium-severity denial of service vulnerability in Xen, published on 18 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
To create and manage guests, domctl operations are used by the control domain, a possible Xenstore domain, or by a domain controlling a particular guest. Some of these operations may not be executed in parallel, so a system-wide lock is used. The way that lock is acquired is, however, not providing any fairness. This is CVE-2026-42489.
Furthermore, with XSM/Flask in use, the lock acquire will, for some operations, occur ahead of any permission checking. This is CVE-2026-42490.
Weakness: CWE-667
Which versions are affected by CVE-2026-42489?
How do I fix CVE-2026-42489?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-42489 being exploited?
There is no known exploitation of CVE-2026-42489 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-42489, DEBIAN-CVE-2026-42489, GHSA-vw8q-74w5-57vq, UBUNTU-CVE-2026-42489.